PsExec使用总结

PsExec是一款free software，可以在连接没有telnet服务的远程windows系统。

http://technet.microsoft.com/zh-cn/sysinternals/bb897553(en-us).aspx

PsExec v1.94
By Mark Russinovich
Published: January 4, 2008
Introduction
Utilities like Telnet and remote control programs like Symantec's PC Anywhere let you execute programs on remote systems, but they can be a pain to set up and require that you install client software on the remote systems that you wish to access. PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.

Note: some anti-virus scanners report that one or more of the tools are infected with a "remote admin" virus. None of the PsTools contain viruses, but they have been used by viruses, which is why they trigger virus notifications.

 Top of page
Installation
Just copy PsExec onto your executable path. Typing "psexec" displays its usage syntax.

PsExec works on Windows Server 2008, Vista, NT 4.0, Win2K, Windows XP and Server 2003 including x64 versions of Windows.

 Top of page
Usage
See the July 2004 issue of Windows IT Pro Magazine for Mark's article that covers advanced usage of PsExec.

usage: psexec [//computer[,computer2[,...] | @file][-u user [-p psswd]][-n s][-l][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-<priority>][-a n,n,... ] cmd [arguments]

computer

Direct PsExec to run the application on the computer or computers specified. If you omit the computer name PsExec runs the application on the local system and if you enter a computer name of "//*" PsExec runs the applications on all computers in the current domain.

@file

Directs PsExec to run the command on each computer listed in the text file specified.

-a

Separate processors on which the application can run with commas where 1 is the lowest numbered CPU. For example, to run the application on CPU 2 and CPU 4, enter: "-a 2,4"

-c

Copy the specified program to the remote system for execution. If you omit this option then the application must be in the system's path on the remote system.

-d

Don't wait for application to terminate. Only use this option for non-interactive applications.

-e

Does not load the specified account's profile.

-f

Copy the specified program to the remote system even if the file already exists on the remote system.

-i

Run the program so that it interacts with the desktop of the specified session on the remote system. If no session is specified the process runs in the console session.

-l

Run process as limited user (strips the Administrators group and allows only privileges assigned to the Users group). On Windows Vista the process runs with Low Integrity.

-n

Specifies timeout in seconds connecting to remote computers.

-p

Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.

-s

Run remote process in the System account .

-u

Specifies optional user name for login to remote computer.

-v

Copy the specified file only if it has a higher version number or is newer on than the one on the remote system.

-w

Set the working directory of the process (relative to the remote computer).

-x

Display the UI on the Winlogon desktop (local system only).

-priority

Specifies -low, -belownormal, -abovenormal, -high or -realtime to run the process at a different priority. Use -background to run at low memory and I/O priority on Vista.

program

Name of the program to execute.

arguments

Arguments to pass (note that file paths must be absolute paths on the target system)

You can enclose applications that have spaces in their name with quotation marks e.g. "psexec //marklap "c:/long name/app.exe". Input is only passed to the remote system when you press the enter key, and typing Ctrl-C terminates the remote process.

If you omit a username the remote process runs in the same account from which you execute PsExec, but because the remote process is impersonating it will not have access to network resources on the remote system. When you specify a username the remote process executes in the account specified, and will have access to any network resources the account has access to. Note that the password is transmitted in clear text to the remote system.

You can use the current version of PsExec as a Runas replacement when you target the local system because PsExec does not require you to be an administrator.

 Top of page
Examples
This article I wrote describes how PsExec works and gives tips on how to use it:

http://www.winnetmag.com/Windows/Issues/IssueID/714/Index.html

The following command launches an interactive command prompt on //marklap:

psexec //marklap cmd

This command executes IpConfig on the remote system with the /all switch, and displays the resulting output locally:

psexec //marklap ipconfig /all

This command copies the program test.exe to the remote system and executes it interactively:

psexec //marklap -c test.exe

Specify the full path to a program that is already installed on a remote system if its not on the system's path:

psexec //marklap c:/bin/test.exe

Run Regedit interactively in the System account to view the contents of the SAM and SECURITY keys::

psexec -i -d -s c:/windows/regedit.exe

To run Internet Explorer as with limited-user privileges use this command:

psexec -l -d "c:/program files/internet explorer/iexplore.exe"

psexec是一个远程执行工具，你可以像使用telnet一样使用它。
它的使用格式为：
psexec //远程机器ip [-u username [-p password]] [-c [-f]] [-i][-d] program [argum
ents]
它的参数有：
-c <[路径]文件名>:拷贝文件到远程机器并运行（注意：运行结束后文件会自动删除）
-d 不等待程序执行完就返回，（比如要让远程机器运行tftp服务端的时候使用，不然psexec
命令会一直等待tftp程序结束才会返回）
-i 在远程机器上运行一个名为psexesvc进程，(到底什么用弄不明白）
假设我在远程机器ip有一个账号，账号名是：abc 密码是：123
比如想要用telnet一样在远程系统上执行命令可以打：
psexec //远程机器ip -u abc -p 123 cmd
如果想要远程机器执行本地c:/srm.exe文件可以打：
psexec //远程机器ip -u abc -p 123 -c c:/srm.exe
如果想要让远程机器执行本地上tftp服务端，(假设tftp服务端在本地c:/tftp32.exe)，可以
打：
psexec //远程机器ip -u abc -p 123 -c c:/tftp32.exe -d

 

另外：

psexec还可以通过连接已打开的远程桌面启动桌面程序。

例：C:/>psexec.exe //servername -u administrator -p password-s -d -i 1 C:/windows/sy
stem32/notepad.exe

其中，-i 后面的数字1 是remote desk top的session ID，可以通过远程服务管理器查看（注意不是通过set s命令）